{"answers":{"affected":"1 open source package ship an affected version, including spectral-net-probe.","exploited":"There is no known exploitation of MAL-2026-18368 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18368 is a malicious package in spectral-net-probe, published on 28 Oct 2026."},"fix_prompt":"MAL-2026-18368 is a malicious package: spectral-net-probe (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18368/ (Markdown: https://insights.sbomify.com/MAL-2026-18368/index.md)","id":"MAL-2026-18368","markdown":"https://insights.sbomify.com/MAL-2026-18368/index.md","name":"MAL-2026-18368","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"spectral-net-probe has no functional code. Versions 1.0.1 and 1.0.4 have a postinstall script that runs `node index.js` on npm install, which sends an HTTPS GET to a Cloudflare quick tunnel (`https://nobody-johnston-with-enabling.trycloudflare.com/aa?x=1` and `https://imaging-amazing-trunk-surgeons.trycloudflare.com/marker104?v=1`). Version 1.0.10 runs when the package is loaded: it fetches `/api/modules/ECT-654321` from `http://154.57.164.64:30664` and `http://127.0.0.1:3000`, reads up to ten local files whose paths the reply lists in `data.cargo_hold`, and PUTs the first 400 characters of their contents to `/api/modules/ECT-987654` on both hosts. It was published by the npm account kristol07, which published two more packages the same day (phantom-chartwinds and phantom-powder-keg, placeholder versions only so far).\n\nspectral-net-probe@1.0.10 is an active supply-chain attack. package.json declares a postinstall hook `node -e \"require('.').sync()\"` that loads index.js on `npm install`. index.js runs a top-level loop over a hardcoded base list including the bare-IP endpoint 154.57.164.64:30664, GETs `/api/modules/ECT-654321` to receive a comma-separated list of filesystem paths, reads each path with fs.readFileSync, and PUTs the file contents back to `/api/modules/ECT-987654` on the same remote. The remote operator chooses which files on the installer's host are read and uploaded. The uploaded body is wrapped in a fake `ecto_module` YAML manifest with fields like `cargo_hold` and `power_level: SYNCED`, and the package self-describes as a 'local module config sync helper' — a cover story disguising arbitrary file exfiltration as benign module-sync telemetry. The hardcoded bare-IP destination is not associated with any legitimate publisher infrastructure.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in spectral-net-probe (npm)","id":"MAL-2026-18368","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"spectral-net-probe","purl":"pkg:npm/spectral-net-probe","source":"MAL-2026-18368"}],"products":null,"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18368/"}